I have a script that updates certain policies via the Casper API. These policies are scoped to multiple smart groups in multiple sites. During testing, where I didn't have multiple sites, everything worked fine. But in production, I get some strange behavior: The API policy PUT call returns "Error: ComputerGroup (ID:xxx, Name:Blahblahblah) is enabled for a site." Subsequent GET calls on the policy return updated information, as though the PUT succeeded. The updated information is NEVER reflected in the JSS. After some time, API GETs again return the old information, confirming the original failure. Why is this failing? Why does it matter if a smart group is site-enabled in the first place? Why is the API returning false data? Any ideas? I'm hoping someone has seen this before. If not, I'll try to create a simplified, generic script to share that reproduces the problem.

I have some VPP apps (Xcode being one) set to self service, but I would also like it "pre-installed" on certain open access computers (OSX 10.11). Is this possible from JSS? I can only seem to select "self service" or "install automatically"... If not, is there a way you can invoke a VPP install via a script of some kind?

What happens if the push notification certificate expires ?

Hi, does anybody already found solution how to disable Siri setup during first configuration? So I'm using script to disable iCloud, diagnostics and setup windows and enable location services however in macOS Sierra we also have window to enable or disable Siri. I tried with script to modify com.apple.SetupAssistant.plist same as with iCloud but with Siri it's not working. Any ideas or working solutions?

First time poster here so please take it easy. What I am trying to achieve is seemingly simple, in principle, but boy has this given me a headache. What I need to achieve is this: When an LDAP user logs into a system, Safari launches with a specified URL. Only Safari should be accessible. That's it. Nothing more and nothing less. Why is this so difficult or am I being stupid? ( I am prepared to be told I am being stupid). I can't find anything in a config profile that allows this. Any suggestions would be helpful.

Will cocoa dialogue run as the root user? I'm currently getting the following error when running as a policy: Script result: 2017-09-06 14:11:11.575 cocoaDialog[86217:1180463] CFPasteboardRef CFPasteboardCreate(CFAllocatorRef, CFStringRef) : failed to create global data<br/>2017-09-06 14:11:11.576 cocoaDialog[86217:1180463] CFPasteboardRef CFPasteboardCreate(CFAllocatorRef, CFStringRef) : failed to create global data<br/>2017-09-06 14:11:11.576 cocoaDialog[86217:1180463] CFPasteboardRef CFPasteboardCreate(CFAllocatorRef, CFStringRef) : failed to create global data<br/>2017-09-06 14:11:11.578 cocoaDialog[86217:1180463] CFPasteboardRef CFPasteboardCreate(CFAllocatorRef, CFStringRef) : failed to create global data<br/>2017-09-06 14:11:11.926 cocoaDialog[86217:1180463] CFPasteboardRef CFPasteboardCreate(CFAllocatorRef, CFStringRef) : failed to create global data<br/>2017-09-06 14:11:11.926 cocoaDialog[86217:1180463] CFPasteboardRef CFPasteboardCreate(CFA

Hi all, I'm a bit new to JAMF but am finding it really useful. I'm good on deploying applications to macOS, but I am wondering what the best practice is for removing applications that have been deployed with a policy. Thanks!

I am trying to import a computer using the mac or serial number into the JSS using the api. I am not understanding the syntax for this. I have an xml file with both pieces of information in it ready to be imported. I understand the command will look something like "https://myjss:8443/JSSResource/computers/" after that I am unsure of what to put in for a path. I know it should end with /path/to/xmlfile -X POST. The big picture is that I will be receiving new imacs and would like to take an excel inventory of the mac addresses and serial numbers, export it to xml and import the entries into the JSS so I can group computers and scope policies before the computers arrive. I am fine with needing to add more information to the xml file such as platform, os version and so on if it helps with the pre-deployment. I could try to do prestage imaging to simply install the apps I want, but I was hoping to be able to front load computer groups and policy scoping. I am using JSS 9.61 and am

We use com.google.Chrome in a user-level configuration profile to force install the uBlock extension in Chrome. This has been working great. We are running into issues in our K-12 where staff and students are complaining about some content being blocked by uBlock that is causing issues. We created a github page with a text file on it that is our whitelist so we can update it quickly if needed. We got this to work on our windows machines via Group Policy by following these directions Those instructions have a portion about creating a plist for setting the extension policies, which I did like this: filename: com.google.Chrome.extensions.cjpalhdlnbpafiamejdnhcphjbkeiagm.plist <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>adminSettings</key> <string>{"userSettings":{"autoUpdate":true,"externalLists":"https://r

Our Prod JSS 9.100.0 version is showing different menu name (I think these are database names). The QA JSS 9.100.0 version is not doing this. Do anyone know how to correct this issue?

I have updated our NBI using AutoCasper NBI 1.3.4 using a base OS of 10.12.2 (16A323) and Casper Imaging 9.81. When I attempt to boot from the NBI it just comes up with a prohibitory symbol. Is there something I might be missing here as to why this won't Netboot? Just in case I am using a startech US1GC30W USB-C to Gigabit Network Adapter. Can anyone provide me some tips on what I should look for? Thank you

I currently have a bash script to add printers for teachers, but would like to make it more user friendly.I'd like to use applescript or automator to make a more friendly GUI. Also does anyone know how to insert a users pin into the account track settings of a printer? so far my script looks like: I have a function setup for each of the choices that installs the appropriate printer. Again what I'd like to do is make checkboxes or something so they can install multiple printers, along with having text box for them to input their pin# used for the copier, and take that pin and input it to the account track settings of the printer and save it.

I have seen some variations on this but am yet to find one that meets my needs fully. We have a problem with users desktops becoming the personal dumping ground for anything and everything. Ideally, I would like to be able to run a script that puts all the files on their desktop, ignoring web links (we have some support links on there we need them to keep) into a folder the script creates on their desktop. Is it possible?

Hello, I manage a handful of labs. I am trying to use MySides to configure the Finder Sidebar to be basically empty. I installed the MySides binary on my target machines. When I run "mysides remove all" in terminal on the local machine, it works exactly as expected.. all sidebar items disappear. But if I run that same command via Casper Remote, or with a policy, it never works. I also tried saving the command as an executable script on the local machine, and calling that with a policy, but it still doesn't work - but if I launch the script on the local machine by double clicking, it works just fine. I am still a little bit of a novice with this sort of thing. Am I missing something? Is there a better way to do this? Thanks

Hello, I have a Mac that refuses to check-in or update inventory by itself. It does if you sudo jamf policy or sudo jamf recon. Things I've tried:1. Ran a quick-add package2. Removed MDM Profile (sudo jamf removeMDMprofile)3. Reinstalled MDM Profile (sudo jamf manage)4. Re-enrolled (sudo jamf enroll -prompt) All of them ran without any issue and made the machine check-in/update inventory. However, the issue remains. I have more than 100 other Macs that are not having this issue. Has anyone encountered this before? Any advice? Thanks!

Has anyone successfully packaged this using Composer insofar that launching the program doesn't prompt you for a Name, Organization, Serial Number and Registration Code? Thanks in advance for any advice!

Firefox 55.0.2 released 8/16, but our JSS is still showing 55.0.1 as the latest at of 12:20 on 8/22. We're pushing out to production after our normal test cycle and I had to change our smart group to manually enter the version ##. Any chance of an SLA coming on how quickly patches will be reflected? Depending on the severity of any security issues on patches, we have requirements on how quickly we have to patch them, definitely can't wait a week for JAMF to catch up to the patch if it is classified as "critical" (not the case this time, fortunately).

I'm trying to add an URL to allow flash player plugin to work as one of the testing site relies on it. I've tried scripting this and does write it in the plist but doesn't reflect on chrome. I did see the configuration profile method but rather not use that as I've seen inconsistency in the past. Any help would be appreciated! #!/bin/sh # iReady_URL_Chrome.sh # # # Created by jkim on 5/2/17. # LIU=`ls -l /dev/console | cut -d " " -f 4` sudo defaults write /Users/$LIU/Library/Preferences/com.google.Chrome.plist PluginsAllowedForUrls ""[*.]i-ready.com""

Has anyone been able to select/deselect categories under System Preferences > Spotlight with the JSS? I know that ~/Library/Preferences/com.apple.spotlight.plist gets modified when a category is manually changed in the GUI. But if i change it directly in the plist nothing seems to update in the GUI. I've tried relaunching the Agent/Daemon but without luck: launchctl unload -w /System/Library/LaunchAgents/com.apple.Spotlight.plist launchctl unload -w /System/Library/LaunchDaemons/com.apple.metadata.mds.plist launchctl load -w /System/Library/LaunchAgents/com.apple.Spotlight.plist launchctl load -w /System/Library/LaunchDaemons/com.apple.metadata.mds.plist Has anyone been able to set this with a Configuration Profile or Policy? I've seen this done with a package (https://jamfnation.jamfsoftware.com/discussion.html?id=13235) but am curious if there is a non-packaged option.

Hi Everyone, I'm working my way through the various aspects of my JSS. Next up is printers! I see a lot of options available for deploying printers, but basically I'm just trying to identify the best solution for my environment. So here's the scenario: I have a heavy Windows environment with Active Directory. All printers are shared off of various Windows print servers bound to AD. The queues are hosted on the print servers, users connect to the print server, install the printer of their choice, drivers download and install, etc.. From an AD-bound Mac if I go to add a printer (+) all of the shared printers on the domain show up, each listed as Open Directory. This all looks very promising so far. DriversIs it best to package up individual drivers? Or just deploy the massive driver packages that Apple provides (http://support.apple.com/kb/dl907)? Printer Capture and UploadWould it be recommended to add these domain printers to a test machine as mentioned above, and s

We have an issue with a policy that was set to run offline at recurring check-in but has since had the scope reduced to no computers and changed to "once per computer". For some strange reason, we still have a handful of clients that are running the policy and logging it with the JSS on a daily basis. I imagine a removeframework and re-enroll will definitely take care of the issue but the main question I have is this: Where do offline policies live and how can I ensure they've been removed?

Trying to get the username of the currently logged in user during a Login policy. I have tried all sorts of ways: $3, stat -f%Su /dev/console, and through /dev/console. I wasn't getting the desired results from the script. I echoed the variable back and checked the policy logs. Every user comes back with <br/> appended to it. I even tried trimming the last 5 characters, but it doesn't remove the break code. An example of the log:Script result: Current logged in user: hopeg14<br/>User home: /Users/hopeg14<br/> I have only started noticing this since the JSS upgrade to 9.100.0Any thoughts?

I'm wondering if anyone knows or has stumbled upon a script for Binding to AD that prompts to select an OU out of multiple selections. I work for a company that has multiple department OUs. The Windows side has a power shell script that prompts the user to select the OU, I would love to have something similar on the Mac side. I did some searching around to no avail, my guess is that there might be a better way to do this that I'm not considering. Any help on this would be greatly appreciated :)

Bonjour, Nous débutons dans notre entreprise avec le DEP, c'est encore en phase de test. Côté DEP, tout fonctionne. Un PreStage Enrollment a été créé, tout fonctionne à merveille, sauf la partie qui doit créer un compte supplémentaire administrateur. Cela ne fonctionne pas. Le compte administrateur n'est jamais créé, ce qui fait que l'utilisateur qui ouvre son compte avec l'AD récupère les droits d'administration… Ci-dessous, le PreStage Enrollment crée : Il y a sûrement quelque chose que je ne fais pas correctement.Des idées ? :) Merci par avance,Bien à vous,

Hi, We have just started with DEP in our enterprise. A user-initiated enrollment has been configured : We have set an prestage enrollment with a few options (directory, account settings…).When we run the setup assistance DEP on scoped computer, this computer does not enroll. But we can see it in inventory with the name « DEP - Serial Number ». I probably forget something… We have tested in 10.10.5 and it's works, but not in 10.12.5.Our JSS is in 9.97. Have you met same issue ? Many thanks for your support,